I'm trying to change the SID of various user in Samba 4.1.14 using pdbedit
pdbedit --user <username> SID=<SID>
I run the command but no message is displayed nor the SID is changed.
How can I modify users' SID in Samba 4.1.14?
I'm trying to change the SID of various user in Samba 4.1.14 using pdbedit
pdbedit --user <username> SID=<SID>
I run the command but no message is displayed nor the SID is changed.
How can I modify users' SID in Samba 4.1.14?
Samba 4 domain controllers ignore pdbedit
's attempts to set SIDs. To change a user's SID, you'll have to use the ldb-tools
package to edit the SAM LDB in the Samba state directory directly. New Samba versions have a private/sam.ldb.d
subdirectory containing one LDB file per naming context, e.g. DC=EXAMPLE,DC=COM.ldb
; some versions might just have the private/sam.ldb
file.
Caution: It is a good idea to back up the Samba domain before tinkering with its state.
Once you've identified the file of interest, stop the Samba service. Invoke ldbedit
to edit one record in that LDB specified by the username whose SID needs to be adjusted:
sudo ldbedit -e nano -H /var/lib/samba/private/sam.ldb.d/DC=EXAMPLE,DC=COM.ldb '(samaccountname=someone)'
# ~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~
# editor of choice LDB of interest username
Caution: You are responsible for making sure the SID you choose is not also used by an existing or future account.
Adjust the SID on the objectSid
line, save the file, and exit the text editor. ldbedit
will apply the change and you can restart the Samba service.
Years later... There is no way to do that! For the mentioned versions at the time. I tried!
@msmafra I tested it with Samba 4.11.2 on CentOS 8 and it works.
Also it can be run on a single line without editors, as follows. -e parameter can be use with other commands like sed, cat and etc.
ldbedit -e 'sed -i "s/OLD_SID/NEW_SID/g"' -H /var/lib/samba/private/sam.ldb.d/DC\=EXAMPLE\,DC\=LAB.ldb "(objectSid=OLD_SID)"